Cherry-picked from quattro (7d58bb9a).
Stop world-writable Chromium and Firefox policy directories: create them
root-owned at 0755, purge non-root entries, refuse planted symlinks, and
write the browser theme colour through a passwordless helper instead of
a world-writable policy file.
Conflict resolution for v4-0-2:
- bin/omarchy-install-browser: dropped the `chromium)` case, which does
not exist on this branch.
- test/shell.d/default-apps-test.sh: dropped; the file does not exist on
this branch.
Ryan Hughes